Blocking Specific Email / Domain With Content Filtering

I am trying to block emails from specific users in Mail Security for Exchange. We have premium antispam protection as well. We run Exchange 2007 on Server 2008 R2 and we do not have an edge transport server. I have followed two separate walkthroughs and neither one works correctly in blocking the specified email addresses (or domains):

The reason I want to block certain addresses or domains is because they don't always meet the premium antispam filters. Example: A person's EarthLink email address was hijacked and is emailing specific users in our system that are on their EarthLink address book several times a day with varied email content. I am also getting specific emails from a specific domain where the premium antispam doesn't block it. I've forwarded the various emails to the brightmail address, but they don't pick it up as something to block automatically in the rules. So I want to block that manually.

If the content filters for creating a match list with content filtering rules do not work, what else can I try? Any suggestions are appreciated.

I was able to get the rule to work by selecting it to check "Outbound Messages". I really don't know why Outbound Messages has to be selected, especially if the message is from an external sender outside our system and is technically an "Inbound Message". Maybe our Exchange is setup in a weird way, but having Inbound Messages or Internal Store checked did not process the rule, which is what the walkthroughs indicated.